43f393caec
This patch adds a new netfilter target which creates audit records for packets traversing a certain chain. It can be used to record packets which are rejected administraively as follows: -N AUDIT_DROP -A AUDIT_DROP -j AUDIT --type DROP -A AUDIT_DROP -j DROP a rule which would typically drop or reject a packet would then invoke the new chain to record packets before dropping them. -j AUDIT_DROP The module is protocol independant and works for iptables, ip6tables and ebtables. The following information is logged: - netfilter hook - packet length - incomming/outgoing interface - MAC src/dst/proto for ethernet packets - src/dst/protocol address for IPv4/IPv6 - src/dst port for TCP/UDP/UDPLITE - icmp type/code Cc: Patrick McHardy <kaber@trash.net> Cc: Eric Paris <eparis@parisplace.org> Cc: Al Viro <viro@ZenIV.linux.org.uk> Signed-off-by: Thomas Graf <tgraf@redhat.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
31 lines
655 B
C
31 lines
655 B
C
/*
|
|
* Header file for iptables xt_AUDIT target
|
|
*
|
|
* (C) 2010-2011 Thomas Graf <tgraf@redhat.com>
|
|
* (C) 2010-2011 Red Hat, Inc.
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License version 2 as
|
|
* published by the Free Software Foundation.
|
|
*/
|
|
|
|
#ifndef _XT_AUDIT_TARGET_H
|
|
#define _XT_AUDIT_TARGET_H
|
|
|
|
#include <linux/types.h>
|
|
|
|
enum {
|
|
XT_AUDIT_TYPE_ACCEPT = 0,
|
|
XT_AUDIT_TYPE_DROP,
|
|
XT_AUDIT_TYPE_REJECT,
|
|
__XT_AUDIT_TYPE_MAX,
|
|
};
|
|
|
|
#define XT_AUDIT_TYPE_MAX (__XT_AUDIT_TYPE_MAX - 1)
|
|
|
|
struct xt_audit_info {
|
|
__u8 type; /* XT_AUDIT_TYPE_* */
|
|
};
|
|
|
|
#endif /* _XT_AUDIT_TARGET_H */
|